GHSA-wxhq-pm8v-cw75
Regular Expression Denial of Service in clean-css
GHSA-wxhq-pm8v-cw75 is a vulnerability with no CVSS score yet in clean-css, published June 5, 2019. No source lists public exploit code. Fixed in clean-css 4.1.11.
- Severity
- UnratedNo CVSS score yet
- Exploit chance
- UnscoredNo EPSS score yet
- Exploitation
- None knownNot on CISA’s or ENISA’s lists
- Fixed in
4.1.11clean-css +3 more
Description
Version of clean-css prior to 4.1.11 are vulnerable to Regular Expression Denial of Service (ReDoS). Untrusted input may cause catastrophic backtracking while matching regular expressions. This can cause the application to be unresponsive leading to Denial of Service.
Recommendation
Upgrade to version 4.1.11 or higher.
Affected packages
| Package | Affected | Fixed |
|---|---|---|
clean-cssnpm | before 4.1.11 | 4.1.11 |
clean-cssTuxCare:npm | 2.2.23-tuxcare.0 up to 2.2.23-tuxcare.1, plus listed versions 2.2.23 | 2.2.23-tuxcare.1 |
clean-cssTuxCare:npm | 3.4.28-tuxcare.0 up to 3.4.28-tuxcare.1, plus listed versions 3.4.28 | 3.4.28-tuxcare.1 |
clean-cssTuxCare:npm | 3.4.28-tuxcare.0 up to 3.4.28-tuxcare.2, plus listed versions 3.4.283.4.28-tuxcare.1 | 3.4.28-tuxcare.2 |
What each source reports
GitHub AdvisoriesNo score
Regular Expression Denial of Service in clean-css
Version of clean-css prior to 4.1.11 are vulnerable to Regular Expression Denial of Service (ReDoS). Untrusted input may cause catastrophic backtracking while matching regular expressions. This can cause the application to be unresponsive leading to Denial of Service.
Recommendation
Upgrade to version 4.1.11 or higher.
- Record
GHSA-wxhq-pm8v-cw75- Weakness
- CWE-1333
- Updated
- 2026-11-02
OSVCLSA-2026-1773706622No score
TuxCare security update for clean-css (1 CVE)
TuxCare rebuilt clean-css to address 1 CVE. Fixed in 2.2.23-tuxcare.1.
- Record
CLSA-2026-1773706622- Updated
- 2026-11-02
OSVCLSA-2026-1774138775No score
TuxCare security update for clean-css (1 CVE)
TuxCare rebuilt clean-css to address 1 CVE. Fixed in 3.4.28-tuxcare.1.
- Record
CLSA-2026-1774138775- Updated
- 2026-11-02
OSVCLSA-2026-1793867509No score
TuxCare security update for clean-css (1 CVE)
TuxCare rebuilt clean-css to address 1 CVE. Fixed in 3.4.28-tuxcare.2.
- Record
CLSA-2026-1793867509- Updated
- 2026-11-05
OSVNo score
Regular Expression Denial of Service in clean-css
Version of clean-css prior to 4.1.11 are vulnerable to Regular Expression Denial of Service (ReDoS). Untrusted input may cause catastrophic backtracking while matching regular expressions. This can cause the application to be unresponsive leading to Denial of Service.
Recommendation
Upgrade to version 4.1.11 or higher.
- Record
GHSA-wxhq-pm8v-cw75- Weakness
- CWE-1333
- Updated
- 2026-11-02
History
| Recorded | Changed | Sources |
|---|---|---|
| affected, aliases, facts | OSV | |
| first indexed | GitHub Advisories, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.